Bounds for a doc acc are derived from the frame of that document's root content. When that root content has its own accessible, the update queued [here](https://searchfox.org/firefox-main/rev/6bf7902103ad0177a215d8cb494fcb923f5c3e57/accessible/base/nsAccessibilityService.cpp#607) refreshes that accessible but not the document itself. We need to ensure _both_ are updated. This causes problems when hittesting because ChildAtPoint causes BoundsWithOffset to [mask every descendant against this rect](https://searchfox.org/firefox-main/rev/6bf7902103ad0177a215d8cb494fcb923f5c3e57/accessible/ipc/RemoteAccessible.cpp#1033-1043) when hit-testing, making the message body (and any content inside it) impossible to hittest when that rect has stale bounds. There are a few cases to be concerned about here, and I've enumerated them in the comment below in nsAccessibilityService.cpp. I've also added two new tests. `bodyIsDocAcc` is a test that passes both with and without this patch, but should serve as a regression test for the future. `bodyIsOwnAcc` is the version that fails without the associated .cpp change. Differential Revision: https://phabricator.services.mozilla.com/D307662